Download the ESAPI setup resources and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. NOTE: the AntiSamy file mentioned in the batch file is also included in the archive

If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset

If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.

Close Eclipse

If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse

Navigate to the directory where you installed Eclipse

Right-Click Eclipse.exe and select Create Shortcut

Right-Click your Eclipse shortcut and select Properties

At the end of the line that says Target, add -vm "x" where x is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work

Restart Eclipse using the edited shortcut.

Follow the instructions below for Importing the ESAPI Source.

Importing the ESAPI Source

To import the ESAPI source code into your workspace, you can either download the source files in a zip file from here or download the latest trunk from the ESAPI SVN.

The zip files containing the ESAPI source are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available here).

The ESAPI trunk SVN contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

Source Code From a .zip

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

OR

Subversion Setup

If you choose to use the ESAPI SVN code, follow the instructions here. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:

Click File -> New -> Other.....

From the SVN Folder select '"Checkout Projects from SVN (this option will only be available if you have a SVN plugin installed) and hit Next >.

Click the Create a new repository location radio button.

If you are not listed as a project contributor, insert http://owasp-esapi-java.googlecode.com/svn/trunk/ as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)

Once the directory structure appears in the window, click the URL at the top to download everything. Then hit Next >

Select your desired project options. For most people, the default options should be fine. When finished, click Next >.

Select your desired workspace options, then click Finish. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

Project Setup

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

Once Java 1.4.2+ is installed, open the Navigator view in Eclipse. If this is currently hidden, from the toolbar click Window -> Show View -> Navigator.

Right-click on the ESAPI project root folder in the Navigator view and select Properties.

From the left column, select Java Build Path. Under the Libraries tab, be sure a JRE or JDK is listed next to JRE System Library. If there is a red X on next to the JRE, remove the current JRE and click Add Library and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select Installed JREs and look at the location to which each version is mapped.

The Libraries tab should list JRE System Library and Maven Dependencies. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.

If a red X appears next to Maven Dependencies, click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the script listed above ran without errors.

From the left column, select Java Compiler. Be sure Compiler compliance level, Generated .class files compatibility, and Source compatibility are all set to 1.4. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.